topic Re: FTD DDNS for VPN in Network Security

FTD DDNS for VPN

pannkakan_1 — Fri, 21 Feb 2020 15:56:58 GMT

Hi!

I have a question regarding DDNS and FTD. We get a DHCP address from our ISP on our outside interface which we're using for our VPN clients. We want to bind this address to a more convient name for example: vpn.example.com. I've read about DynDNS and No-IP but it seems you need a software on your computer. I've also found that you can configure this on routers with the CLI but im not sure if its possible on the FTD? I'm managing our FTD with our FMC.

Re: FTD DDNS for VPN

alex.baldwin — Thu, 21 Feb 2019 21:00:08 GMT

I found a way to do this on the FirePower module of the ASA with firepower services (though it is totally unsupported and performed in expert mode) However the Firepower module is not supported in later versions of the 5506 with the REST agent enabled and so I am now trying to find a way to do this with FTD so that I can move to FTD.

Re: FTD DDNS for VPN

alex.baldwin — Thu, 21 Feb 2019 21:01:02 GMT

Re: FTD DDNS for VPN

darknight — Wed, 26 Jun 2019 14:14:55 GMT

How did you do this?

Re: FTD DDNS for VPN

Mohammed al Baqari — Wed, 26 Jun 2019 17:57:08 GMT

This is how to configure FTD DDNS from FMC.

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/dhcp_and_ddns_services_for_firepower_threat_defense.html

Re: FTD DDNS for VPN

Mohammed al Baqari — Wed, 26 Jun 2019 17:57:57 GMT

Remember to rate useful posts

Re: FTD DDNS for VPN

alex.baldwin — Fri, 28 Jun 2019 18:27:07 GMT

Mohammed is correct but in that document Cisco is referring to DDNS for clients behind an ASA that are using the ASA for DHCPD. I was referring to DDNS of the ASA public IP (acquired from the ISP via DHCP) to a service like DynDNS etc. Which is not a feature Cisco provides, and I don't know why. so I installed the DynDNS client on the Linux FirePower instance (SFR). I'm sure if there was a support issue, the TAC engineer's head would spin around, but it was required in this instance as there was no client on the inside that could be used to register DynDNS.

Re: FTD DDNS for VPN

darknight — Wed, 03 Jul 2019 12:43:44 GMT

I was able to do this with an ASA years ago with CradlePoint devices. It's hard to believe Firepower would offer less functionality than ASA, but I'm finding this more and more to be the case.

Re: FTD DDNS for VPN

alex.baldwin — Wed, 03 Jul 2019 14:06:59 GMT

How did you do it with ASA, because I don't think I see a DynDNS integration with ASA either.

Re: FTD DDNS for VPN

darknight — Wed, 03 Jul 2019 14:36:56 GMT

I created a dynamic map then referenced it in the crypto map.

This was years ago, but I think this was the Cisco document I used to get started - https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118652-configure-asa-00.html

Re: FTD DDNS for VPN

IvanAlvarenga25979 — Wed, 10 Feb 2021 16:10:57 GMT

Is it possible to configure it using FDM ( no FMC ) ?

Re: FTD DDNS for VPN

Mohammed al Baqari — Wed, 10 Feb 2021 16:59:19 GMT

AFAIK it can be done from FMC only.